The following describes how to configure One Identity Safeguard for Privileged Sessions (SPS) to retrieve the credentials used to login to the target host using a custom plugin.

Prerequisites

  • To use a custom Credential Store plugin, you have to upload a working Credential Store plugin to SPS. This plugin is a script that can be used to access an external Credential Store or Password Manager. If you want to create such a custom Credential Store plugin, contact our Support Team or see Introduction in the Creating Custom Credential Store Plugins.

    For more information on uploading plugins, see Uploading plugins.

    NOTE: Users accessing connections that use Credential Stores to authenticate on the target server must authenticate on SPS using gateway authentication. Therefore, gateway authentication must be configured for these connections. For details, see Configuring gateway authentication.

  • Verify the integrity of the plugin.

    For more information on verifying the integrity of plugins, see Verifying the integrity of a plugin.

To configure SPS to retrieve the credentials used to login to the target host using a custom plugin

  1. Navigate to Policies > Credential Stores.

  2. Click and enter a name for the Credential Store.

  3. Select External Plugin, then select the plugin to use from the Plugin list.

  4. If your plugin supports configuration, then you can create multiple customized configuration instances of the plugin for your site. The Configuration textbox displays the example configuration of the plugin you selected. If you wish to create a customized configuration instance of the plugin for your site, then edit the configuration here.

    NOTE: Plugins created and issued before the release of SPS 5.1 do not support configuration. If you create a configuration for a plugin that does not support this, the affected connection will stop with an error message.

  5. Click .

  6. Navigate to the Connection policy where you want to use the Credential Store (for example, to Traffic Controls > SSH > Connections), select the Credential Store configuration instance to use in the Credential Store field, then click .